Fedora has issued an advisory today (March 5): https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/WL735FW266GO4C2JX4CJBOIOB7R7AY5A/ The issue is fixed upstream in 0.7.1. Mageia 8 is also affected.
Various people have dealt with this pkg, so assigning the update globally.
Assignee: bugsquad => pkg-bugs
Suggested advisory: ======================== The updated packages fix a security vulnerability: swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of swtpm's state, where the blobheader's hdrsize indicator has an invalid value, may cause an out-of-bounds access when the byte array representing the state of the TPM is accessed. This will likely crash swtpm or prevent it from starting since the state cannot be understood. Users should upgrade to swtpm v0.5.3, v0.6.2, or v0.7.1 to receive a patch. There are currently no known workarounds. (CVE-2022-23645) References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23645 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/WL735FW266GO4C2JX4CJBOIOB7R7AY5A/ ======================== Updated packages in core/updates_testing: ======================== lib(64)wtpm_libtpms0-0.7.1-1.mga8 lib(64)wtpm_libtpms-devel-0.7.1-1.mga8 swtpm-0.7.1-1.mga8 swtpm-tools-0.7.1-1.mga8 swtpm-tools-pkcs11-0.7.1-1.mga8 from SRPM: swtpm-0.7.1-1.mga8.src.rpm
CVE: (none) => CVE-2022-23645Assignee: pkg-bugs => qa-bugsCC: (none) => nicolas.salgueroSource RPM: swtpm-0.7.0-5.mga9.src.rpm => swtpm-0.7.0-5.mga8.src.rpmVersion: Cauldron => 8Status: NEW => ASSIGNED
MGA8-64 Plasma on Lenovo B50 in Dutch No installation issues. No wiki or previous updates. Trying to read searching google what this is all about, I decided i would need a few weeks of studying to get a grasp on this. Happy that this installation does not rip anything else apart. I wull nor object OK'ing thison clean install,but someone else in command can decide on this.
CC: (none) => herman.viaene
The introduction from https://www.smoothnet.org/qemu-tpm/ says this: "Windows 11 and the new Windows Server will require a TPM (Trusted Platform Module) to be installed to run. Here is how you can emulate the TPM on a RHEL/CentOS/Rocky Linux virtualization host. Install the required packages on your virtualization host. They are swtpm (a software TPM emulator) and swtpm-tool (a set of tools that allow libvirt to interact with the emulator)." So I take it that these packages are needed, probably among other things, to run Windows 11 in QEMU. I agree, Herman, that this would take an inordinate amount of time and effort to study and master. More than is typically asked of QA. OKing on a clean install, and validating. Advisory in Comment 2.
CC: (none) => andrewsfarm, sysadmin-bugsWhiteboard: (none) => MGA8-64-OKKeywords: (none) => validated_update
CC: (none) => davidwhodginsKeywords: (none) => advisory
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2022-0112.html
Resolution: (none) => FIXEDStatus: ASSIGNED => RESOLVED